The haul is enormous. One file, labelled \u201cyoutube_music,\u201d had logged more than 2 million clips. Others list tens of thousands of hours pulled from Deezer, Genius, and the stock library Pond5. In all, it adds up to decades of recorded music.<\/p>\n
Ripping the vocals<\/p>\n
The code is specific about what it wanted. To capture clean voices, it hunted for a cappella versions of songs on YouTube. To slip past YouTube\u2019s defences, Suno routed its scraping through a proxy firm called Bright Data. It also trawled 420,000 podcasts, chasing roughly a million hours of speech.<\/p>\n
![](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2026\/07\/tnw-newsletter.png\"\/)
<\/p>\n
The \ud83d\udc9c of EU tech<\/p>\n
The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!<\/p>\n
None of this is entirely new. In court, Suno has already admitted training on \u201cessentially all music files of reasonable quality\u201d on the open web. But the leak shows the machinery behind that line.<\/p>\n
The record labels have long alleged as much. Suing Suno, the RIAA said the company copied \u201cdecades worth of the world\u2019s most popular sound recordings,\u201d and did it by \u201cstream ripping\u201d from YouTube, dodging the platform\u2019s copy protections.<\/p>\n
\u2018Fair use,\u2019 Suno says<\/p>\n
Suno\u2019s defence, like most AI firms, is fair use<\/a>. It says it trains on \u201cpublicly available music files\u201d and builds its models for \u201coriginal creation.\u201d It even leaves artist names out of its training data, to discourage copycats.<\/p>\n On the breach, the company played it down. It called the November 2025 incident \u201climited\u201d and \u201cquickly contained,\u201d said the exposed code was outdated, and insisted no sensitive data leaked. It does not hold customers\u2019 full card numbers, it added, and it decided it did not need to tell users at all.<\/p>\n The hacker, who goes by ellie.191, tells a different story. They said they got in through the Shai-Hulud worm<\/a>, grabbed an employee\u2019s credentials, and pulled customer emails, phone numbers, and Stripe records. Suno never warned those users, some of them told 404 Media. The motive? \u201cI like to hack anything and everything.\u201d<\/p>\n The bigger fight<\/p>\n The timing matters. Some labels have already made peace, striking licensing deals<\/a> with AI firms rather than fighting on. Sony is still in court, with a pivotal fair-use ruling due this summer.<\/p>\n